Solana FakeFix Campaign Uses 25 Malicious npm and PyPI Packages to Steal Developer Secrets

A sophisticated threat dubbed the Solana FakeFix campaign. Threat actors deployed 25 malicious packages across the npm and PyPI ecosystems to compromise developer environments.

Disguised as stable-build fixes and official SDK tooling, these packages specifically target Solana developers.

Once installed, they silently execute malicious code to harvest highly sensitive data, including wallet keys, cloud credentials, source-control tokens, and environment secrets.

Simultaneously, researchers discovered a parallel campaign involving CMS-themed npm packages designed to deploy Windows loaders and dynamically run remote executables.

FakeFix Packages Steal Secrets

The FakeFix operation uses packages carefully named to impersonate legitimate Solana developer tools. Libraries like @solana-labs/web3.js leverage typosquatting and fake branding to attract victims experiencing dependency friction.

The attackers actively promoted these malicious libraries using GitHub issue spam. A threat actor known as “PassWord1337” opened multiple issues in open-source projects, falsely advertising their package as a drop-in replacement that resolved common build errors.

Initial delivery relied on basic npm lifecycle execution hooks. The moment a developer installed the package, attacker-controlled JavaScript executed in the background without requiring the library to be imported.

The malware immediately configured a Telegram command-and-control server and scanned the local system for valuable files, such as id.json, .env files, and AWS credentials.

The PyPI variants embedded their payload within the initialization file, lying dormant until a developer imported the package during testing or application startup.

Running parallel to the Solana attacks, a secondary campaign uploaded by the user “thermonuclear” targeted developers with CMS-themed packages.

Libraries such as cms-storehub and shopifyto-cms abandoned their cryptocurrency angle and began functioning as Windows loaders and droppers.

These packages utilized npm lifecycle hooks to launch hidden PowerShell scripts. The primary goal was to install Deno, a modern JavaScript runtime, to execute remote code on the compromised machine, JFrog said.

The obfuscated payload acted as an advanced Windows loader. It established persistence through the Windows Registry, gathered system identifiers, and communicated with a C2 server using JSON Web Tokens.

This architecture allowed the operator to seamlessly rotate final payloads while keeping the initial package loader stable.

Other variants functioned as simple droppers, fetching disguised executables and running them from temporary directories before attempting a quick cleanup.

Organizations must act quickly to remove all affected packages from developer machines, build workers, and internal caches.

Because backdoor commands and registry persistence may have already been executed, developers must completely rebuild affected CI runners from trusted images.

Defenders should actively hunt for persistence artifacts, such as npm lifecycle-created scripts, unauthorized Registry Run keys, and rogue startup VBS files.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.